Paranoid2000
04-01-2003, 05:03 PM
In the description of Super Stealth, it is stated that users can get complete security in their Ethernet segment since they would only be responding to ARP requests from "trusted" hosts (I have not run the plugin but simply read the first thread on the forum - if I am wrong, please fire away :) ).
The assumption being made here is that an intruder would not be able to find your MAC address since your PC would not respond to any ARP requests he issues. If he does not have your MAC address he cannot send you any Ethernet packets.
However, an attacker on your local segment does not need to send an ARP request to find your MAC address. If he puts his network card into "promiscuous mode" (where it passes all packets it receives to the operating system - normally it filters everything except broadcasts, multicasts and packets with its MAC address), he can see what packets your PC is sending or receiving. These would include your MAC address. This is a straightforward task for any sniffer program.
In other words, if your PC is sending or receiving any data on the network, Super Stealth cannot provide real protection. Once an attacker has your MAC address, he can start sending data to your PC where it would be up to Outpost itself to filter it.
Could Super Stealth be altered to change this? Filtering all incoming packets (rather than just ARP requests) except those from "trusted" MAC addresses would make life a little more difficult for an attacker - he would then have to identify a trusted MAC address and alter the source address on his packets accordingly. This would however not be too difficult - using a sniffer again...
One possibility for better security is to have mutating MAC addresses - where your PC's address is frequently changed in a pseudo-random fashion, (eg based on a hash including the current time, previously used address, etc). That way, even if an attacker is using a sniffer, he would only find past addresses - not your current one.
This approach does have real difficulties though. While some network cards allow their MAC address to be changed, I am not certain that all do. This would also require similar software at the router/gateway to keep up with the MAC address changes. At this point, it would appear beyond the scope of Super Stealth or Outpost itself to provide that level of security - and would make network troubleshooting a real pain.
While I do not wish to sound discouraging - I do feel that in its current form, Super Stealth cannot provide more than a few moments' obstruction to a local attacker. Those who need this level of security should be considering solutions like IPsec (which includes packet authentication and encryption at IP packet level as described here (http://www.netbsd.org/Documentation/network/ipsec/)).
The assumption being made here is that an intruder would not be able to find your MAC address since your PC would not respond to any ARP requests he issues. If he does not have your MAC address he cannot send you any Ethernet packets.
However, an attacker on your local segment does not need to send an ARP request to find your MAC address. If he puts his network card into "promiscuous mode" (where it passes all packets it receives to the operating system - normally it filters everything except broadcasts, multicasts and packets with its MAC address), he can see what packets your PC is sending or receiving. These would include your MAC address. This is a straightforward task for any sniffer program.
In other words, if your PC is sending or receiving any data on the network, Super Stealth cannot provide real protection. Once an attacker has your MAC address, he can start sending data to your PC where it would be up to Outpost itself to filter it.
Could Super Stealth be altered to change this? Filtering all incoming packets (rather than just ARP requests) except those from "trusted" MAC addresses would make life a little more difficult for an attacker - he would then have to identify a trusted MAC address and alter the source address on his packets accordingly. This would however not be too difficult - using a sniffer again...
One possibility for better security is to have mutating MAC addresses - where your PC's address is frequently changed in a pseudo-random fashion, (eg based on a hash including the current time, previously used address, etc). That way, even if an attacker is using a sniffer, he would only find past addresses - not your current one.
This approach does have real difficulties though. While some network cards allow their MAC address to be changed, I am not certain that all do. This would also require similar software at the router/gateway to keep up with the MAC address changes. At this point, it would appear beyond the scope of Super Stealth or Outpost itself to provide that level of security - and would make network troubleshooting a real pain.
While I do not wish to sound discouraging - I do feel that in its current form, Super Stealth cannot provide more than a few moments' obstruction to a local attacker. Those who need this level of security should be considering solutions like IPsec (which includes packet authentication and encryption at IP packet level as described here (http://www.netbsd.org/Documentation/network/ipsec/)).